Email: 345680 Autolearn: 0 AvgScore: 2.33 AvgScanTime: 2.20 sec Spam: 81893 Autolearn: 0 AvgScore: 15.28 AvgScanTime: 2.85 sec Ham: 263787 Autolearn: 0 AvgScore: -1.69 AvgScanTime: 2.00 sec Time Spent Running SA: 211.27 hours Time Spent Processing Spam: 64.91 hours Time Spent Processing Ham: 146.36 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 70864 86.39 86.53 86.35 2 DCC_CHECK 63450 55.64 77.48 48.86 3 DKIM_SIGNED 46874 74.98 57.24 80.48 4 XM_B_Unicode 46474 68.92 56.75 72.70 5 XM_DK_Pass 44493 73.63 54.33 79.63 6 DKIM_VALID 42141 70.57 51.46 76.50 7 XMListUnsubscribeExists 37204 55.20 45.43 58.23 8 BAYES_50 36804 51.46 44.94 53.48 9 MIME_HTML_ONLY 34226 28.32 41.79 24.14 10 DKIM_VALID_AU 32430 56.97 39.60 62.36 11 RELAYCOUNTRY_META 31796 12.81 38.83 4.73 12 XM_B_Unicode3 30943 43.58 37.78 45.38 13 BOTNET 27358 9.53 33.41 2.12 14 XM_UncommonTLD01 24953 10.85 30.47 4.76 15 UNTRUSTED_Relay 24144 8.03 29.48 1.37 16 HTML_FONT_LOW_CONTRAST 23691 31.53 28.93 32.34 17 BOTNET_IPINHOSTNAME 22220 11.13 27.13 6.16 18 XM_DK_Undo_02 21977 12.91 26.84 8.59 19 FSL_BULK_SIG 21332 12.27 26.05 8.00 20 LOC_TINY_FONT_1 17722 26.61 21.64 28.15 21 XMSubLong 17378 21.44 21.22 21.51 22 XM_Body_Dirty_Words 17255 15.84 21.07 14.22 23 DCC_CHECK_NEGATIVE 17170 43.10 20.97 49.97 24 MultiRelay 16476 16.58 20.12 15.48 25 BAYES_99 16473 8.85 20.12 5.36 26 FVGT_m_MULTI_ODD 16230 21.52 19.82 22.05 27 DKIM_VALID_EF 15263 26.66 18.64 29.15 28 XM_B_Unsub 13467 12.33 16.44 11.05 29 RCVD_IN_BL_SPAMCOP_NET 13436 4.95 16.41 1.39 30 T_REMOTE_IMAGE 12648 6.97 15.44 4.34 31 T_TM2_M_HEADER_IN_MSG 12617 21.95 15.41 23.98 32 BAYES_999 12524 7.02 15.29 4.46 33 TR_DCC_Bayes_99 12368 5.52 15.10 2.55 34 HTML_SHORT_LINK_IMG_1 12035 3.50 14.70 0.02 35 XMSexyCombo_05 11867 7.24 14.49 4.99 36 MIME_HEADER_CTYPE_ONLY 11542 3.40 14.09 0.09 37 KHOP_HELO_FCRDNS 11211 4.16 13.69 1.20 38 XM_Multi_Part_URI 11106 14.14 13.56 14.33 39 LOTS_OF_MONEY 11075 10.48 13.52 9.53 40 HDRS_LCASE_IMGONLY 10978 3.19 13.41 0.02 41 SpammyFromTLD_02 10386 3.13 12.68 0.16 42 XM_UB50 10246 3.52 12.51 0.73 43 RCVD_IN_RP_RNBL 10084 2.98 12.31 0.08 44 FROM_SUSPICIOUS_NTLD 9918 2.89 12.11 0.03 45 FROM_SUSPICIOUS_NTLD_FP 9887 2.88 12.07 0.03 46 T_KAM_HTML_FONT_INVALID 9858 15.94 12.04 17.15 47 XMSubMetaSx_00 9488 6.33 11.59 4.70 48 HTML_IMAGE_RATIO_02 8923 11.57 10.90 11.78 49 HTML_MIME_NO_HTML_TAG 8119 3.55 9.91 1.58 50 XMNumbers 7962 5.85 9.72 4.65 51 BOTNET_NORDNS 7799 2.29 9.52 0.04 52 DKIM_ADSP_NXDOMAIN 7589 3.37 9.27 1.53 53 XM_DIRTYINTL 7562 4.12 9.23 2.53 54 LongTLD 7479 2.26 9.13 0.13 55 RCVD_IN_PSBL 6918 2.09 8.45 0.11 56 T_XMDrugObfuBody_14 6736 7.39 8.23 7.13 57 REPLYTO_WITHOUT_TO_CC 6726 1.97 8.21 0.04 58 XM_H_Long_From01 6620 7.01 8.08 6.68 59 HTML_IMAGE_ONLY_12 6595 2.02 8.05 0.15 60 XM_Evil_Numbers_Gen 6299 10.09 7.69 10.83 61 HDRS_MISSP 6245 1.84 7.63 0.04 62 HTML_IMAGE_ONLY_08 6225 1.88 7.60 0.10 63 SHORT_IMG_SUSP_NTLD 6154 1.78 7.51 0.00 64 XM_SPF_SoftFail 6070 2.67 7.41 1.20 65 BAYES_60 5691 5.66 6.95 5.26 66 BAYES_80 5619 3.79 6.86 2.83 67 MPART_ALT_DIFF 5566 5.29 6.80 4.83 68 XM_B_SpammyTLD 5254 3.21 6.42 2.21 69 RCVD_IN_MSPIKE_BL 5159 2.39 6.30 1.18 70 RELAYCOUNTRY_DE 5051 1.67 6.17 0.27 71 TooManyTo_001 4919 6.20 6.01 6.26 72 MIME_HTML_MOSTLY 4822 3.38 5.89 2.60 73 TO_EQ_FM_DOM_HTML_IMG 4776 1.38 5.83 0.00 74 RCVD_IN_MSPIKE_H2 4745 8.39 5.79 9.19 75 BAYES_40 4737 5.15 5.78 4.95 76 DKIM_INVALID 4733 4.41 5.78 3.98 77 FROM_EXCESS_BASE64 4602 5.14 5.62 4.99 78 XM_B_Phish_Phrases 4470 6.24 5.46 6.49 79 XM_CamelCaseFrm001 4422 3.18 5.40 2.49 80 HTML_IMAGE_RATIO_04 4117 6.25 5.03 6.62 81 XMSexyCombo_01 3787 1.68 4.62 0.76 82 LotsOfNums_01 3695 7.33 4.51 8.21 83 BAYES_00 3640 16.01 4.44 19.60 84 RELAYCOUNTRY_CA 3594 2.64 4.39 2.10 85 RCVD_IN_MSPIKE_L5 3582 1.19 4.37 0.21 86 URI_NOVOWEL 3521 1.33 4.30 0.41 87 BAYES_20 3452 4.09 4.22 4.05 88 MultiRelay_CC 3349 1.11 4.09 0.18 89 MultiRelay_Combo 3349 1.11 4.09 0.18 90 RELAYCOUNTRY_FR 3221 1.15 3.93 0.28 91 DIET_1 3179 1.72 3.88 1.05 92 RELAYCOUNTRY_CN 3121 0.93 3.81 0.04 93 SpammyFromTLD_01 3109 1.20 3.80 0.40 94 ALL_TRUSTED 3039 11.49 3.71 13.90 95 XM_SendGrid 3008 5.96 3.67 6.68 96 NO_DNS_FOR_FROM 2993 2.63 3.65 2.31 97 BAYES_95 2986 2.23 3.65 1.79 98 NORDNS_LOW_CONTRAST 2778 0.81 3.39 0.00 99 XM_B_Unsub2 2582 2.24 3.15 1.95 100 MIME_HTML_ONLY_MULTI 2543 2.87 3.11 2.79 101 XM_UB60 2458 0.76 3.00 0.06 102 XMStrtUSub 2360 4.48 2.88 4.97 103 XMMoneyMeta_00 2343 0.89 2.86 0.27 104 TM2_M_URI_OPT_OUT 2327 1.84 2.84 1.53 105 T_FILL_THIS_FORM_SHORT 2290 1.66 2.80 1.31 106 BAYES_05 2234 2.45 2.73 2.37 107 RELAYCOUNTRY_GB 2214 1.03 2.70 0.52 108 XMHTML_After_End 2133 1.45 2.60 1.09 109 HTML_IMAGE_RATIO_06 2103 3.58 2.57 3.89 110 RCVD_IN_MSPIKE_WL 2084 8.12 2.54 9.85 111 RCVD_IN_MSPIKE_H3 2082 8.11 2.54 9.84 112 CHARSET_FARAWAY_HEADER 2060 0.61 2.52 0.02 113 TR_Mismatch_TLD_02 2056 0.64 2.51 0.06 114 T_TooManySym_01 2044 5.50 2.50 6.43 115 DKIM_ADSP_CUSTOM_MED 2013 1.37 2.46 1.03 116 XMPhish11 1996 1.28 2.44 0.92 117 RELAYCOUNTRY_FI 1947 0.57 2.38 0.01 118 SUBJ_ALL_CAPS 1945 2.35 2.38 2.35 119 T_Symld_Words_02 1934 1.01 2.36 0.60 120 NML_ADSP_CUSTOM_MED 1931 1.12 2.36 0.73 121 XM_OfRef6 1928 1.45 2.35 1.17 122 DATE_IN_PAST_03_06 1895 0.64 2.31 0.13 123 URI_HEX 1882 1.66 2.30 1.46 124 XMSlimDrugH 1840 0.83 2.25 0.39 125 FORGED_GMAIL_RCVD 1827 1.02 2.23 0.64 126 MIME_CHARSET_FARAWAY 1820 0.58 2.22 0.06 127 MIME_QP_LONG_LINE 1783 4.22 2.18 4.86 128 XM_H_PHPMailer 1752 0.90 2.14 0.52 129 HTML_IMAGE_RATIO_08 1750 2.08 2.14 2.06 130 SUBJ_DOLLARS 1723 0.81 2.10 0.41 131 MISSING_HEADERS 1678 0.68 2.05 0.25 132 XMSexyCombo_04 1650 0.55 2.01 0.10 133 XMDiploma_00 1642 1.28 2.01 1.05 134 RDNS_DYNAMIC 1631 0.89 1.99 0.55 135 T_XMDrugObfuBody_08 1588 1.43 1.94 1.27 136 RCVD_IN_RP_SAFE 1582 11.78 1.93 14.84 137 TR_XM_DK_SendGrid 1518 3.46 1.85 3.96 138 LOADSA_MONEY_COMBO 1514 0.50 1.85 0.08 139 TR_XM_RelayPhish 1505 1.34 1.84 1.19 140 XM_UB99 1500 0.44 1.83 0.01 141 INVALID_MSGID 1477 2.60 1.80 2.84 142 NO_FM_NAME_IP_HOSTN 1461 0.42 1.78 0.00 143 UNPARSEABLE_RELAY 1428 3.28 1.74 3.76 144 XMSlimDrugs 1410 0.47 1.72 0.08 145 TR_XM_PHPDW 1394 0.76 1.70 0.47 146 XM_UB80 1367 0.41 1.67 0.02 147 TR_XM_DK_Bayes 1358 13.26 1.66 16.87 148 FILL_THIS_FORM 1357 0.81 1.66 0.54 149 TR_XM_PHPForged 1348 0.72 1.65 0.44 150 T_XMHurry_00 1340 1.06 1.64 0.89 151 TM2_M_VERY_LONG_WORD 1338 1.63 1.63 1.63 152 TR_XM_FormFill2 1334 0.72 1.63 0.44 153 XM_H_PHPOS 1323 0.71 1.62 0.43 154 FILL_THIS_FORM_LONG 1315 0.71 1.61 0.44 155 HK_RANDOM_FROM 1305 0.48 1.59 0.13 156 XMWghtMeta_00 1274 0.41 1.56 0.05 157 HK_RANDOM_REPLYTO 1268 0.54 1.55 0.23 158 HTML_SHORT_LINK_IMG_2 1268 0.39 1.55 0.03 159 XMGenDplmaNmb 1249 0.80 1.53 0.58 160 CHARSET_FARAWAY 1246 0.36 1.52 0.00 161 TR_XM_DK_Bayes1 1225 12.78 1.50 16.29 162 XM_URI_RBL 1222 0.69 1.49 0.44 163 TR_XM_INV_DKIM 1218 0.54 1.49 0.25 164 XMSubMetaI_00 1205 0.88 1.47 0.70 165 DOS_RCVD_IP_TWICE_B 1190 0.41 1.45 0.09 166 XMSubMetaSSx_00 1177 0.48 1.44 0.19 167 TR_Symld_Words 1158 1.55 1.41 1.59 168 RELAYCOUNTRY_IE 1150 0.43 1.40 0.13 169 MISSING_MIMEOLE 1101 0.35 1.34 0.05 170 T_XMDrugObfuBody_00 1092 0.83 1.33 0.68 171 URI_TRY_3LD 1053 1.56 1.29 1.65 172 XM_Lotto 1022 0.35 1.25 0.08 173 TooManyTo_002 1019 1.28 1.24 1.29 174 RCVD_IN_MSPIKE_L3 1014 0.84 1.24 0.72 175 T_TooManySym_02 1011 2.93 1.23 3.46 176 XMPhish04 1010 0.30 1.23 0.01 177 XM_UB999 999 0.29 1.22 0.01 178 RCVD_IN_RP_CERTIFIED 994 10.20 1.21 12.99 179 MSGID_SHORT 989 0.29 1.21 0.01 180 TR_Sbj_FN_Bdy 987 0.37 1.21 0.11 181 TO_EQ_FM_DIRECT_MX 981 0.29 1.20 0.01 182 RELAYCOUNTRY_IN 979 0.31 1.20 0.04 183 XMSubMetaSxObfu_03 975 0.78 1.19 0.66 184 URIBL_DBL_SPAM 967 0.32 1.18 0.05 185 FORGED_MUA_OUTLOOK 959 0.31 1.17 0.04 186 XM_H_Undi_Recip 955 0.41 1.17 0.17 187 XMBody_17 953 0.91 1.16 0.83 188 RELAYCOUNTRY_RU 943 0.28 1.15 0.01 189 DATE_IN_PAST_06_12 943 0.32 1.15 0.06 190 XM_H_Long_From02 930 1.22 1.14 1.25 191 MAILING_LIST_MULTI 929 1.62 1.13 1.77 192 FVGT_m_MULTI_ODD_EMAIL 923 0.29 1.13 0.03 193 XM_H_TOP 923 0.27 1.13 0.00 194 RELAYCOUNTRY_UA 918 0.27 1.12 0.00 195 HK_SCAM 908 0.28 1.11 0.02 196 XM_Attn_01 908 0.30 1.11 0.05 197 MILLION_USD 900 0.27 1.10 0.01 198 MONEY_FORM_SHORT 895 0.28 1.09 0.03 199 RELAYCOUNTRY_TR 887 0.26 1.08 0.01 200 RCVD_IN_IADB_LISTED 878 3.12 1.07 3.76 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 227782 86.39 86.53 86.35 2 DKIM_SIGNED 212300 74.98 57.24 80.48 3 XM_DK_Pass 210046 73.63 54.33 79.63 4 DKIM_VALID 201791 70.57 51.46 76.50 5 XM_B_Unicode 191762 68.92 56.75 72.70 6 DKIM_VALID_AU 164494 56.97 39.60 62.36 7 XMListUnsubscribeExists 153604 55.20 45.43 58.23 8 BAYES_50 141068 51.46 44.94 53.48 9 DCC_CHECK_NEGATIVE 131824 43.10 20.97 49.97 10 DCC_CHECK 128880 55.64 77.48 48.86 11 XM_B_Unicode3 119702 43.58 37.78 45.38 12 HTML_FONT_LOW_CONTRAST 85297 31.53 28.93 32.34 13 DKIM_VALID_EF 76888 26.66 18.64 29.15 14 LOC_TINY_FONT_1 74248 26.61 21.64 28.15 15 MIME_HTML_ONLY 63671 28.32 41.79 24.14 16 T_TM2_M_HEADER_IN_MSG 63249 21.95 15.41 23.98 17 FVGT_m_MULTI_ODD 58172 21.52 19.82 22.05 18 XMSubLong 56736 21.44 21.22 21.51 19 BAYES_00 51692 16.01 4.44 19.60 20 T_KAM_HTML_FONT_INVALID 45245 15.94 12.04 17.15 21 TR_XM_DK_Bayes 44495 13.26 1.66 16.87 22 TR_XM_DK_Bayes1 42959 12.78 1.50 16.29 23 MultiRelay 40831 16.58 20.12 15.48 24 TR_XM_DK_Bayes2 40331 11.90 1.00 15.29 25 RCVD_IN_RP_SAFE 39143 11.78 1.93 14.84 26 XM_Multi_Part_URI 37790 14.14 13.56 14.33 27 XM_Body_Dirty_Words 37501 15.84 21.07 14.22 28 ALL_TRUSTED 36676 11.49 3.71 13.90 29 RCVD_IN_RP_CERTIFIED 34268 10.20 1.21 12.99 30 HTML_IMAGE_RATIO_02 31083 11.57 10.90 11.78 31 XM_DKIMWhitelistDomains 29268 8.47 0.01 11.10 32 XM_B_Unsub 29160 12.33 16.44 11.05 33 XM_Evil_Numbers_Gen 28574 10.09 7.69 10.83 34 RCVD_IN_MSPIKE_WL 25976 8.12 2.54 9.85 35 RCVD_IN_MSPIKE_H3 25952 8.11 2.54 9.84 36 LOTS_OF_MONEY 25145 10.48 13.52 9.53 37 RCVD_IN_MSPIKE_H2 24245 8.39 5.79 9.19 38 XM_DK_Undo_02 22664 12.91 26.84 8.59 39 LotsOfNums_01 21658 7.33 4.51 8.21 40 FSL_BULK_SIG 21099 12.27 26.05 8.00 41 T_XMDrugObfuBody_14 18804 7.39 8.23 7.13 42 XM_H_Long_From01 17610 7.01 8.08 6.68 43 XM_SendGrid 17609 5.96 3.67 6.68 44 HTML_IMAGE_RATIO_04 17472 6.25 5.03 6.62 45 XM_B_Phish_Phrases 17112 6.24 5.46 6.49 46 T_TooManySym_01 16959 5.50 2.50 6.43 47 TooManyTo_001 16522 6.20 6.01 6.26 48 BOTNET_IPINHOSTNAME 16260 11.13 27.13 6.16 49 BAYES_99 14134 8.85 20.12 5.36 50 BAYES_60 13867 5.66 6.95 5.26 51 XMSexyCombo_05 13169 7.24 14.49 4.99 52 FROM_EXCESS_BASE64 13159 5.14 5.62 4.99 53 XMStrtUSub 13119 4.48 2.88 4.97 54 BAYES_40 13053 5.15 5.78 4.95 55 MIME_QP_LONG_LINE 12821 4.22 2.18 4.86 56 MPART_ALT_DIFF 12737 5.29 6.80 4.83 57 XM_UncommonTLD01 12546 10.85 30.47 4.76 58 RELAYCOUNTRY_META 12472 12.81 38.83 4.73 59 XMSubMetaSx_00 12405 6.33 11.59 4.70 60 XMNumbers 12271 5.85 9.72 4.65 61 BAYES_999 11754 7.02 15.29 4.46 62 T_REMOTE_IMAGE 11439 6.97 15.44 4.34 63 BAYES_20 10679 4.09 4.22 4.05 64 DKIM_INVALID 10509 4.41 5.78 3.98 65 TR_XM_DK_SendGrid 10451 3.46 1.85 3.96 66 HTML_IMAGE_RATIO_06 10260 3.58 2.57 3.89 67 RCVD_IN_IADB_LISTED 9918 3.12 1.07 3.76 68 UNPARSEABLE_RELAY 9915 3.28 1.74 3.76 69 T_TooManySym_02 9123 2.93 1.23 3.46 70 IN_ZIMBRA_NJ_WHITELIST 8519 2.47 0.01 3.23 71 RCVD_IN_IADB_SPF 8457 2.67 0.93 3.21 72 INVALID_MSGID 7495 2.60 1.80 2.84 73 TVD_RCVD_IP 7487 2.36 0.82 2.84 74 BAYES_80 7467 3.79 6.86 2.83 75 RCVD_IN_IADB_SENDERID 7422 2.36 0.90 2.81 76 MIME_HTML_ONLY_MULTI 7361 2.87 3.11 2.79 77 RCVD_IN_IADB_DK 7135 2.28 0.90 2.70 78 MIME_HTML_MOSTLY 6871 3.38 5.89 2.60 79 CK_HELO_DYNAMIC_SPLIT_IP 6799 2.19 0.96 2.58 80 HELO_DYNAMIC_IPADDR2 6797 2.06 0.40 2.58 81 TR_DCC_Bayes_99 6726 5.52 15.10 2.55 82 RCVD_IN_IADB_VOUCHED 6672 2.01 0.34 2.53 83 XM_DIRTYINTL 6669 4.12 9.23 2.53 84 TO_MALFORMED 6617 1.92 0.00 2.51 85 XM_CamelCaseFrm001 6563 3.18 5.40 2.49 86 XM_PDF 6414 1.93 0.31 2.43 87 BAYES_05 6241 2.45 2.73 2.37 88 SUBJ_ALL_CAPS 6195 2.35 2.38 2.35 89 NO_DNS_FOR_FROM 6104 2.63 3.65 2.31 90 XM_B_SpammyTLD 5826 3.21 6.42 2.21 91 BOTNET 5600 9.53 33.41 2.12 92 RELAYCOUNTRY_CA 5531 2.64 4.39 2.10 93 HTML_IMAGE_RATIO_08 5432 2.08 2.14 2.06 94 XMBdyGiftCard01 5308 1.71 0.76 2.01 95 XM_B_Unsub2 5148 2.24 3.15 1.95 96 XM_H_Trusted_IP 4784 1.38 0.00 1.81 97 BAYES_95 4718 2.23 3.65 1.79 98 USER_IN_DEF_DKIM_WL 4697 1.36 0.01 1.78 99 MAILING_LIST_MULTI 4667 1.62 1.13 1.77 100 IN_HORDE_ADDRESS_BOOK 4532 1.32 0.03 1.72 101 RCVD_IN_IADB_OPTIN 4347 1.32 0.28 1.65 102 URI_TRY_3LD 4340 1.56 1.29 1.65 103 TM2_M_VERY_LONG_WORD 4306 1.63 1.63 1.63 104 TR_Symld_Words 4200 1.55 1.41 1.59 105 HTML_MIME_NO_HTML_TAG 4166 3.55 9.91 1.58 106 XMGappySubj_01 4154 1.32 0.50 1.57 107 TM2_M_URI_OPT_OUT 4049 1.84 2.84 1.53 108 DKIM_ADSP_NXDOMAIN 4046 3.37 9.27 1.53 109 URI_HEX 3852 1.66 2.30 1.46 110 ANY_BOUNCE_MESSAGE 3800 1.16 0.25 1.44 111 BOUNCE_MESSAGE 3795 1.16 0.25 1.44 112 RCVD_IN_BL_SPAMCOP_NET 3664 4.95 16.41 1.39 113 UNTRUSTED_Relay 3623 8.03 29.48 1.37 114 XM_RXBody 3580 1.15 0.47 1.36 115 TR_MetaPhish_Combo_01 3492 1.17 0.66 1.32 116 T_FILL_THIS_FORM_SHORT 3453 1.66 2.80 1.31 117 TooManyTo_002 3408 1.28 1.24 1.29 118 T_XMDrugObfuBody_08 3351 1.43 1.94 1.27 119 XM_DK_Undo_01 3349 1.15 0.76 1.27 120 XM_H_Long_From02 3297 1.22 1.14 1.25 121 XM_SPF_SoftFail 3175 2.67 7.41 1.20 122 KHOP_HELO_FCRDNS 3163 4.16 13.69 1.20 123 TR_XM_RelayPhish 3126 1.34 1.84 1.19 124 RCVD_IN_MSPIKE_BL 3106 2.39 6.30 1.18 125 XMStockSpam_06 3094 1.14 1.02 1.17 126 XMBody_95 3093 0.91 0.06 1.17 127 XM_OfRef6 3088 1.45 2.35 1.17 128 XM_ProductURIs 3040 1.09 0.90 1.15 129 XM_GoogleGroups 2942 0.93 0.32 1.12 130 XMHTML_After_End 2876 1.45 2.60 1.09 131 XM_B_REG_HTML 2774 0.85 0.20 1.05 132 DIET_1 2772 1.72 3.88 1.05 133 XMDiploma_00 2767 1.28 2.01 1.05 134 XMSubNoVowel 2758 0.99 0.80 1.05 135 DKIM_ADSP_CUSTOM_MED 2710 1.37 2.46 1.03 136 AC_FROM_MANY_DOTS 2690 0.78 0.01 1.02 137 XMPhish11 2439 1.28 2.44 0.92 138 USER_IN_WHITELIST 2345 0.68 0.00 0.89 139 T_XMHurry_00 2341 1.06 1.64 0.89 140 TooManyTo_003 2326 0.91 1.02 0.88 141 XMBody_17 2201 0.91 1.16 0.83 142 PLING_QUERY 2182 0.78 0.62 0.83 143 XMPhish30 2120 0.82 0.86 0.80 144 HTML_TAG_BALANCE_BODY 2101 0.83 0.95 0.80 145 T_TooManySym_03 2035 0.61 0.10 0.77 146 XMSexyCombo_01 2006 1.68 4.62 0.76 147 NML_ADSP_CUSTOM_MED 1934 1.12 2.36 0.73 148 XM_UB50 1930 3.52 12.51 0.73 149 RCVD_IN_MSPIKE_L3 1889 0.84 1.24 0.72 150 TooManyTo_004 1845 0.73 0.82 0.70 151 XMSubMetaI_00 1838 0.88 1.47 0.70 152 HTML_FONT_FACE_BAD 1789 0.69 0.75 0.68 153 T_XMDrugObfuBody_00 1788 0.83 1.33 0.68 154 XMSubMetaSxObfu_03 1732 0.78 1.19 0.66 155 XMBrknScrpt_02 1721 0.61 0.49 0.65 156 FORGED_GMAIL_RCVD 1685 1.02 2.23 0.64 157 TooManyTo_005 1630 0.63 0.68 0.62 158 XMHTMLBadTable_001 1584 0.71 1.07 0.60 159 T_Symld_Words_02 1571 1.01 2.36 0.60 160 XMSubMetaSxObfu_02 1557 0.51 0.24 0.59 161 TM2_M_A_HREF_HREF 1526 0.62 0.76 0.58 162 XMBSHREFv2 1521 0.47 0.13 0.58 163 XMGenDplmaNmb 1521 0.80 1.53 0.58 164 HELO_NODOT 1486 0.60 0.70 0.56 165 HELO_NO_DOMAIN 1485 0.59 0.69 0.56 166 HTML_IMAGE_ONLY_20 1482 0.48 0.20 0.56 167 XMBody_78 1466 0.56 0.56 0.56 168 RDNS_DYNAMIC 1462 0.89 1.99 0.55 169 FILL_THIS_FORM 1434 0.81 1.66 0.54 170 XM_Body_Obfu01 1390 0.45 0.20 0.53 171 XM_H_PHPMailer 1373 0.90 2.14 0.52 172 RELAYCOUNTRY_GB 1359 1.03 2.70 0.52 173 XM_B_COPY_HTML 1359 0.51 0.51 0.52 174 XMGappySubj_02 1303 0.44 0.26 0.49 175 TR_XM_PHPDW 1236 0.76 1.70 0.47 176 XMRcvdHeader_15 1206 0.35 0.00 0.46 177 HTML_TEXT_INVISIBLE_STYLE 1202 0.39 0.17 0.46 178 XM_URI_RBL 1172 0.69 1.49 0.44 179 TR_XM_FormFill2 1165 0.72 1.63 0.44 180 XMSolicitRefs_0 1161 0.51 0.74 0.44 181 TR_XM_PHPForged 1158 0.72 1.65 0.44 182 FILL_THIS_FORM_LONG 1148 0.71 1.61 0.44 183 FSL_THIS_IS_ADV 1144 0.36 0.12 0.43 184 XM_H_PHPOS 1142 0.71 1.62 0.43 185 XM_SPF_Unknown 1118 0.45 0.53 0.42 186 XMNoVowels 1094 0.35 0.16 0.41 187 XMLngstWrd_00 1077 0.47 0.66 0.41 188 SUBJ_DOLLARS 1073 0.81 2.10 0.41 189 URI_NOVOWEL 1069 1.33 4.30 0.41 190 XMCapTrack 1062 0.35 0.20 0.40 191 FILL_THIS_FORM_LOAN 1059 0.47 0.70 0.40 192 MPART_ALT_DIFF_COUNT 1056 0.46 0.66 0.40 193 SpammyFromTLD_01 1051 1.20 3.80 0.40 194 GAPPY_SUBJECT 1051 0.32 0.05 0.40 195 XM_ShortIntro_01 1039 0.50 0.84 0.39 196 XMSlimDrugH 1029 0.83 2.25 0.39 197 T_OBFU_PDF_ATTACH 995 0.30 0.05 0.38 198 TR_LOTS_OF_MONEY2 990 0.48 0.82 0.38 199 T_MONEY_PERCENT 990 0.48 0.82 0.38 200 TR_Mismatch_TLD_01 984 0.38 0.39 0.37 ----------------------------------------------------------------------